Security and status

Notabene’s security practices and documents are in its Trust Center and on its security page. Any interruption to the service shows on the status page as it happens, and for anything else you can write to [email protected].

Security in your integration

Topic	Where it is explained
API credentials, access tokens and delegate tokens	How to request, keep and rotate them: Authentication.
Personal data	Who can read it, and end-to-end encryption: Encryption.
Webhook deliveries	How to check that a delivery comes from Notabene: Webhooks.
Firewalls	The hosts and addresses to allow: Notabene IPs.
Support requests	What to send when a call fails: Errors.

Topic	Where it is explained
API credentials, access tokens and delegate tokens	How to request, keep and rotate them: Authentication.
Personal data	Who can read it, and end-to-end encryption: Encryption.
Webhook deliveries	How to check that a delivery comes from Notabene: Webhooks.
Firewalls	The hosts and addresses to allow: Notabene IPs.
Support requests	What to send when a call fails: Errors.

Audit trail

Every action on your node is recorded with who did it, when, and on which transfer. Your team sees the record in the dashboard under Settings › Audit Log, while your backend reads it from the API, newest first.

Request

cURLNode.jsPythonAPI reference

curl --get https://sandbox.notabene.id/api/v1/audit-events \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --data-urlencode 'transaction_id=8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80' \
  --data-urlencode 'limit=50'const url = new URL('https://sandbox.notabene.id/api/v1/audit-events');
url.searchParams.set('transaction_id', '8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80');
url.searchParams.set('limit', '50');

const response = await fetch(url, {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
  },
});
const answer = response.status === 204 ? null : await response.json();import requests

response = requests.get(
    'https://sandbox.notabene.id/api/v1/audit-events',
    headers={'Authorization': 'Bearer YOUR_ACCESS_TOKEN'},
    params={
      "transaction_id": "8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80",
      "limit": "50"
    },
)
answer = None if response.status_code == 204 else response.json()

What to replace

8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80: The transfer whose events you want

Response200

[
  {
    "seq": 1042,
    "action": "transaction.requirement.resolve",
    "created_at": "2026-10-20T00:48:12Z",
    "transaction_id": "8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80",
    "details": {
      "outcome": "Satisfied",
      "requirement_type": "WalletConfirmationForDisclosure",
      "confirmed_by": "did:web:beneficiary.example:pt"
    }
  }
]

curl --get https://sandbox.notabene.id/api/v1/audit-events \
  --header 'Authorization: Bearer YOUR_ACCESS_TOKEN' \
  --data-urlencode 'transaction_id=8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80' \
  --data-urlencode 'limit=50'

const url = new URL('https://sandbox.notabene.id/api/v1/audit-events');
url.searchParams.set('transaction_id', '8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80');
url.searchParams.set('limit', '50');

const response = await fetch(url, {
  method: 'GET',
  headers: {
    Authorization: 'Bearer YOUR_ACCESS_TOKEN',
  },
});
const answer = response.status === 204 ? null : await response.json();

import requests

response = requests.get(
    'https://sandbox.notabene.id/api/v1/audit-events',
    headers={'Authorization': 'Bearer YOUR_ACCESS_TOKEN'},
    params={
      "transaction_id": "8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80",
      "limit": "50"
    },
)
answer = None if response.status_code == 204 else response.json()

[
  {
    "seq": 1042,
    "action": "transaction.requirement.resolve",
    "created_at": "2026-10-20T00:48:12Z",
    "transaction_id": "8f3c2a1e-5b7d-4c90-a1f2-3e4d5c6b7a80",
    "details": {
      "outcome": "Satisfied",
      "requirement_type": "WalletConfirmationForDisclosure",
      "confirmed_by": "did:web:beneficiary.example:pt"
    }
  }
]

Narrow the list with transaction_id, action, since and until, and read further back by passing the lowest seq you have as before_seq.